CVE-2020-25125

Katalog CVE

CVSS 7.8 · High EPSS 1,3%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada gnupg, gpg4win. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.

Rincian

Terbit di NVD

3 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc patch · advisory vendor
• https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html advisory vendor
• http://www.openwall.com/lists/oss-security/2020/09/03/4 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/09/03/5 mailing list · advisory pihak ketiga
• https://bugzilla.opensuse.org/show_bug.cgi?id=1176034 exploit · issue tracking · advisory pihak ketiga
• https://dev.gnupg.org/T5050 mailing list